37-9
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 37 Configuring Network Security with ACLs
Information About Network Security with ACLs
IPv4 ACL to a Terminal Line
You can use numbered ACLs to control access to one or more terminal lines. You cannot apply named
ACLs to lines. You must set identical restrictions on all the virtual terminal lines because a user can
attempt to connect to any of them.
For procedures for applying ACLs to interfaces, see the “Applying an IPv4 ACL to an Interface” section
on page 37-17. For applying ACLs to VLANs, see the “Monitoring and Maintaining Network Security
with ACLs” section on page 37-19.
IPv4 ACL Application to an Interface Guidelines
• Apply an ACL only to inbound Layer 2 ports.
• Apply an ACL to either outbound or inbound Layer 3 interfaces.
• When controlling access to an interface, you can use a named or numbered ACL.
• If you apply an ACL to a port that is a member of a VLAN, the port ACL takes precedence over an
ACL applied to the VLAN interface.
• If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL
takes precedence over an input Layer 3 ACL applied to the VLAN interface. The port ACL always
filters incoming packets received on the Layer 2 port.
• If you apply an ACL to a Layer 3 interface and routing is not enabled, the ACL only filters packets
that are intended for the CPU, such as SNMP, Telnet, or web traffic. You do not have to enable
routing to apply ACLs to Layer 2 interfaces.
• When private VLANs are configured, you can apply router ACLs only on the primary-VLAN SVIs.
The ACL is applied to both primary and secondary VLAN Layer 3 traffic.
Note By default, the router sends Internet Control Message Protocol (IC MP) unreachable messages when a
packet is denied by an access group. These access-group denied pa ckets are not dropped in hardware but
are bridged to the switch CPU so that it can generate the ICMP-unreachable message. Port ACLs are an
exception. They do not generate ICMP unreachable messag es.
ICMP unreachable messages can be disabled on router ACLs with the no ip unreachables interface
command.
For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL
permits the packet, the switch continues to process the packet. If the ACL rejects the packet, the switch
discards the packet.
For outbound ACLs, after receiving and sending a packet to a controlled interface, the switch checks the
packet against the ACL. If the ACL permits the packet, the switch sends the packet. If the ACL rejects
the packet, the switch discards the packet.
By default, the input interface sends ICMP Unreachable messages whenever a packet is discarded,
regardless of whether the packet was discarded because of an ACL on the input interface or because of
an ACL on the output interface. ICMP Unreachables are normally limited to no more than one every
one-half second per input interface, but this can be changed by using the ip icmp rate-limit unreachable
global configuration command.